Arch Linux Security Advisory ASA-202002-4

Severity: High
Date : 2020-02-08
CVE-ID : CVE-2019-14868
Package : ksh
Type : arbitrary command execution
Remote : No
Link : https://security.archlinux.org/AVG-1095

Summary

The package ksh before version 2020.0.0-2 is vulnerable to arbitrary
command execution.

Resolution

Upgrade to 2020.0.0-2.

pacman -Syu “ksh>=2020.0.0-2”

The problem has been fixed upstream but no release is available yet.

Workaround

None.

Description

A flaw was found in ksh version 2020.0.0 in the evaluation of certain
environment variables. An attacker could use this flaw to override or
bypass environment restrictions to execute shell commands. Services and
applications that allow remote unauthenticated attackers to provide one
of those environment variables could allow them to exploit this issue
remotely.

Impact

An attacker is able to execute arbitrary commands that are blacklisted
on the affected host.

References

https://github.com/att/ast/commit/c7de8b641266bac7c77942239ac659edfee9ecd2
https://security.archlinux.org/CVE-2019-14868